User-mode Linux Kernel | Hacker News Reader

User-mode Linux Kernel

user-mode-linux.sourceforge.net

31 pointsgrifaton21 comments

I used to have paying customers on UML on a Red Hat 7.3 box. I had no idea that UML had been maintained as recently as 2.6.24. I really had no reason to follow it, because UML's niche has been eaten away from both top and bottom.

The bottom: For super-high-density virtual private servers, it makes more sense to use OpenVZ (http://www.openvz.org) and its commercial counterpart, Virtuozzo (http://www.parallels.com). I've seen installations with 300-500 VMs running on a system with 2G of RAM. It's not a great user experience, but it sure is ... dense. This is where those $5/month VPSes came from.

The top: For more conventional virtualization needs, there's Xen and KVM. More flexible, less of a pain in the system administrator's ass. This is the route Slicehost and Linode took.

Just an FYI, Linode used to have UML "back in the day."

There was an interesting quote about a year ago from the CEO of Linode regarding uncertainty of staying with Xen and instead moving on to KVM.

http://searchservervirtualization.techtarget.com/news/151637...

That's not an uncommon experience: http://blog.bytemark.co.uk//2011/02/28/why-we-skipped-xen

What about for sandboxing processes? I've been investigating UML for this use as it seems "lighter" than the other approaches you've outlined yet still gives good network separation and reasonable control from a supervising process. I've also been investigating AppArmor but it seems a little like wrapping a blanket around a bomb so far.. but I'm really just walking around in the dark so far.

Use Linux containers (lxc). Exactly what you need...

I'll have a dig into that next then - thanks! :-)

Linux containers don't offer real separation right now, there are still data leaks and issues such as shutdown -h within a lxc causing the host to shutdown and many other issues. Lxc as of now is barely alpha quality.

There's quite a few sandboxing systems out there: sydbox which is a ptrace based sandbox, gentoo's sandbox which uses LD_PRELOAD, plash which uses a modified version of glibc and thus shared libs.. Take your pick. Personally I would just use openvz and be done with it.

I've never been tempted by AppArmor because SELinux is awesome. The learning curve is brutal, but when it works, it's beautiful.

You configure a targeted policy for a daemon, and that policy describes all of the reasonable behaviour profiles for the daemon. Files and directories are assigned contexts referenced by the policies.

If it attempts to write to a directory that isn't part of its normal context, permission denied. Open an abnormal socket? denied. Abnormal IPC? denied.

When there weren't so many options for Linux virtualisation this was where Linode started out: http://www.linode.com/wiki/index.php/Linode#What_makes_a_Lin...

Not news. UML is at least 12 years old.

We used that for quite a few years, were able to get 40-50 VMs on a Dual-Xeon box with 6GB of memory with no trouble. It's very lightweight and flexible with memory compared to systems like KVM and VirtualBox

UML brings back good memories from OS classes. We had to patch ext3 to add some triviality, and I did it first in UML so I could more easily test and make sure it was working correctly. It felt a lot faster and easier to setup than virtualbox or qemu (my options at the time), although I guess with hardware support and things like hypervisors it's no longer practical.

Interesting. Is this similar to CouldLinux? http://www.cloudlinux.com

Cloud Linux is marketed towards shared hosting providers, often the kind that might have 300-2000 websites on a single server. The isolation prevents rogue PHP scripts from taking down the entire server normally seen with non-updated/misconfigured WordPress or common forum software.

There even exists a port of UML for Windows: http://umlwin32.sourceforge.net/

And that project (indirectly) led to coLinux (http://www.colinux.org/), which runs on Windows at the kernel level. Linus himself called coLinux a dirty hack!

What? That's it? Flagged.

Yeah, where's the Apple logo, right?

Dear downmodders, the submitter should have at least put the fig leaf of an "Ask HN" sentence around this to make this interesting. Otherwise, a post to the homepage of a 12-yr old project makes no sense and is polluting HN.

Comments which complain about articles polluting HN and say nothing other than that the commenter is flagging it are polluting HN, and are against the guidelines:

"Please don't submit comments complaining that a submission is inappropriate for the site. If you think something is spam or offtopic, flag it by going to its page and clicking on the "flag" link. (Not all users will see this; there is a karma threshold.) If you flag something, please don't also comment that you did."

Fair enough. Noted. Thanks for replying.

Reply on news.ycombinator.com